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This article deals with the interrelation of deontic operators in contracts - an aspect often neglected 
when considering only one of the involved parties. On top of an automata-based semantics we 
formalise the onuses that obligations, permissions and prohibitions on one party impose on the other. 
Such formalisation allows for a clean notion of contract strictness and a derived notion of contract 
conflict that is enriched with issues arising from party interdependence. 

1 Introduction 

Deontic modalities such as permission and obligation have been debated exhaustively in the literature, 
and various formalisms exist with different interpretations and axiomatisation of deontic notions. With 
few exceptions, the modalities are usually presented in an impersonal manner, refering only to the subject 
of the modality. For instance, most formalisms enable reasoning about notions such as "John is permitted 
to withdraw cash" and "John is obliged to pay an annual credit card fee". However, in a contractual 
setting, the behaviour involves interaction between the two parties the contract binds, and such statements 
about the ideal behaviour have both a notion of the subject and object of the action. For instance, in a 
contract between John and his bank, the clause "John is permitted to withdraw cash" is about both parties, 
and can be interpreted to mean that if John attempts to withdraw cash, then the bank will not refuse or 
hinder his action. Similarly, the clause "John is obliged to pay an annual credit card fee" places an 
obligation on John to perform an action with the bank as the object of the action, and (arguably) also 
places the onus on the bank to accept the payment. Interacting parties allow for both cooperation and 
interference between the parties in the actions they perform, and thus bring about an additional dimension 
to contract analysis. An interesting corollary to this view, is that permission can now be seen as a first 
class deontic modality. Typically seen as the dual of prohibition, violations of permissions have always 
proved difficult to formalise their violation, mainly since a branching logic analysis is required (if party 
p were to perform a then they would not be stopped from doing so). In an interacting two party system 
context, permission now takes a first class role, obliging the object of the modality to allow the subject 
to perform the action if they so desire. 

Although the work on deontic logic for interacting parties is not abundant, computer scientists have 
studied for various decades concurrent and synchronous composition, notions which embody precisely 
interaction from an action-based perspective. In ifTTl we have presented work-in-progress on how syn- 
chrony can be applied in a contractual setting, using a formal automaton-based model of interacting 
two-party systems in which the parties synchronise over a set of actions. In this paper we extend the 
work presented there to deal with (i) absence of actions; (ii) mutually exclusive actions; (iii) conflicts. 

The rest of the paper is organised as follows. The next section formalises our notions of automata, 
deontic operators, contracts and contracts' strength, which allows us to show, in Section [3] that some 
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contracts cannot be satisfied at the same time and thus lead to a conflict. Finally, in Section |4] we discuss 
related work, and conclude in Section [5] 



2 Regulated Two-Party Systems 
2.1 An Automata-Based View 

To enable direct reasoning about contracts, one requires a model in which the two parties somehow 
interact to agree on which actions to perform. We use the notion of synchronous composition HI to 
model such behaviour. Furthermore, to be able to deal with concurrent obligations (for instance, one 
party being obliged to perform one action and the other being obliged to perform another), we adopt 
multi-action labels on transitions, since if we do not, it would be impossible not to violate a contract in 
which both parties have different obligations at the same time. 

Definition 1 A multi-action automaton S is a tuple (E, Q, qO, —>), where E is the alphabet of actions, Q 

is the set of states, qO 6 Q is the initial state and — >Q Q x 2 £ x Q is the transition relation. We will write 

q A> q' for (q,A,q') G— >, next(q) to be the set of target state and action set pairs of transitions outgoing 

from q (defined to be {(A,q ) \ q — > q'}) and acts(q) to be the set of all action sets on the outgoing 

transitions from q (defined to be {A \ 3q' ■ q — > q'}). We say that an automaton is total, if for every q G <2 

A / 

and ACE, there is a q € Q such that q — )■ q . 

The synchronous composition of two automata Si = (Qi, qOi, —>•,•) for i £ {1,2} (both with alphabet 
L) synchronising over alphabet G, written Si ||g^2» and is defined to be (<2i x Q2, (q0\ ,^2), — >), where 
— > is the classical synchronous composition relation defined below: 

A 1 A 1 

q\ -h q l q2 -^2 <?2 

— — AnG = a a nG = 

(?ii92) ->• {a\,q 2 ) {<HA%) ~* (ai,q' z ) 



A 1 B 1 

q\ ->i q 1 , q 2 ->2 ^2 

, s AUB / / / x r 

(<7i,<?2j > {q\A2) 



We can now define contracts to be automata with each state tagged with the contract which will be in 
force at that point. The contracts will be able to refer to both presence and absence of an action. Given 
an alphabet of actions E, we write E! to refer to the alphabet extended with actions preceded with an 

exclamation mark ! to denote their absence: E! = EU {\a \ a € E}. We use variables x and y to range over 
E!. If jc is already an inverted action x = \a, then expression \x is interpreted to be a. 

Contract clauses are either (i) obligation clauses of the form G p (a) or (? p {\a), which say that party p 
is obliged to perform or not perform action a respectively; or (ii) permission clauses which can be either 
of the form of & p (a) or & p (la) (party p is permitted to perform, or not perform action a respectively). 

Definition 2 A contract clause over alphabet E is structured as follows (where action x S E!, party 
PE{1,2}): 

Clause ::= & p {x) \ & p {x) 

A contract automaton is a total and deterministic multi-action automaton S = (Q, qO, — >), together with 
a total function contract £ Q — > Jp^ause ass ig n i n g a se i of clauses to each state. We use 'tfstf to refer to 
the class of contract automata. 
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Two contract automata are said to be structurally isomorphic if they are structurally identical automata 
(they have the same set of states, initial state and transition relation) but may have different contract 
functions. 

Structurally isomorphic contract automata allow us to reason about the weakening or strengthening of a 
contract by changing the clauses in particular states but respecting the structure (and thus the temporal 
behaviour) of the contract, and will be used in various theorems in the rest of the paper. We can now 
define a regulated two-party system in terms of multi-action automata. 

Definition 3 A regulated two-party system synchronising over the set of actions G is a tuple R = (Si, S2)q, 
where Si = (T*i,Qi,qOi,— >•,■) is a multi-action automaton specifying the behaviour of party i, and si is a 
contract automaton over alphabet Ei U £2- 

The behaviour of a regulated two-party system R, written [[/?]], is defined to be the automaton 
{S\\\gSi)\\y.&^ ■ To make states in such systems more readable, wewillwrite ((<?i ,<?2 ),<?,£/) as {q\^qi)q^- 

A regulated two-party system is well-formed if S\\\gS2 never deadlocks: ^/{q\,qi) • acts (q\, #2) 7^ ®- 

In the rest of the paper we will assume that all systems are well-formed, i.e., do not deadlock. One way 
of guaranteeing this may be by having all system states provide a transition with the empty action. 
Also note that the totality of the contract automaton guarantees that the system behaviour is not con- 
strained, but simply acts to tag the states with the relevant contracts at each point in time. 

2.2 Contract Satisfaction 

Given a two-party system (Si , S2), and a contract automaton srf , we can now define whether or not either 
party is violating the contract when a particular state is reached or a transition is taken. As we will see, a 
dual-view of violation, identifying both bad states and bad transitions, is necessary in a deontic context. 
We will look at the different deontic operators and define the set of violations induced for each of them. 

Definition 4 Functions O p (q^) and F p (q^) give the set of actions respectively obliged to be performed 
and obliged not to be performed by party p. They are defined in terms of the contract clauses in the state. 

O p {q^) = {a I Gp{a) £ contract (q^)} 

F p {q^) — {a I G p (\a) € contract (q^)} 
Action set A is said to be viable for party p in a contract automaton state q^, written viable p (q^ , A), if 
( i) all her obliged actions are included in A but; ( ii) no actions which the party is obliged not to perform 
are included A: 

viable p (q^,A) = O p (q^) C A AF p (q^) DA = 

Since we would like to be able to place blame in the case of a violation, we parametrise contract 
satisfaction and violation by party. 

It is also worth noting that while obligation to perform an action, for instance, is violated in a tran- 
sition which does not include the action, permission is violated by a state in which the opportunity to 
perform the permitted action is not present. The satisfaction predicate will thus be overloaded to be 
applicable to both states and transitions. The predicate satp* (X) will denote that the contract automaton 
£/, reaching state X or traversing transition X, does not constitute a violation for party p. X ranges 
over states and transitions in the composed system. When srf is clear from the context, we simply write 
sat p (X). We start by defining separate satisfaction predicates for the deontic operators. 
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Permission. If party p is permitted to perform shared action a, then the other party p must provide p 
with at least one viable outgoing transition which contains a but does not include any forbidden actions 
(that is, it is viable for p). Permission to perform local actions cannot be violated. In the case of a single 
permission, this can be expressed as follows: 

(?i>?2)<fc, \~p ^ P {a) = true 

{lulijq^ h? ^p( a ) — a£G => 3A G acts(q p ), A' C G c ■ a G A A viable P {q s /,A\J A') 

Similarly, if party p is permitted to not perform action a, then the other party p must provide p with at 
least one viable outgoing transition which does not include a nor any forbidden action. Permission to 
perform local actions can never be violated. In the case of a single permission, this can be expressed as 
follows: 

(9l»92)<fc, \~p & p {\a)= true 

{q\,qi)qrf \~p &p(\a) =aeG => 3A G acts(q p ), A' C G c ■ a £ A A viable p (q^,A UA') 

While actual obligation violations occur when an action is not performed, violations of a permission 
occur when no appropriate action is possible. For any other parameters, the permission is otherwise 
satisfied. 

Example: If p is permitted to withdraw money from the bank, permitted not to deposit, obliged to pay 
the fee, and obliged not to steal (£P p (w), £P p (\d), & p (f), p (\s)), p should provide at least one transition 
that contains both a w and an / and contains neither a d nor an s. 
To combine all permissions in a state, we simply take the conjunction of all conditions: 

sat P p ((q u q 2 ) q J = V^p(x) G q^ ■ {q\,qi)q^ h> ^p( x ) 
All transitions are taken as satisfying the permission satisfaction function. 



Obligation. Obligation brings in constraints on both parties. Given that party p is obliged to per- 
form action a in a state means that (i) party p must include the action in any outgoing transition in the 
composed system in which it participates; and (ii) the other party p must provide a viable synchroni- 
sation action set which, together with other asynchronous actions performed by p, allows p to perform 
all its obligations, positive and negative. Obligation to not perform action a (€? p (la)) can be similarly 
expressed. We combine all positive and negative obligations in the following definition: 

sat p {{q u q 2 ) qi j ^ {q'v^q'J = viable p (q^, A) 
sat2((q u q 2 )q ! s) = 3A G acts(q p ), A' C G c ■ viable p (q & , AU A') 

The satisfaction constraint for transitions is only applicable if A is not an action set performed asyn- 
chronously by p. For other parameters, sat p (X) is true. 

Example: Continuing the previous example, to satisfy sat p , all of /?'s outgoing transitions must be s-free 
and must have an /, while p should offer at least one transition that contains an / and not an s. That is, 
if at a given state p offers only outgoing transitions labeled {/, s} then she is forcing p to an s in order to 
have an /, and thus not satisfying its part in /?'s obligations. 
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General contract satisfaction. It is defined as: sat p (X) = satZiX) Asat p (X). Based on this, we can 
now define correctness of a regulated two-party system. 

Definition 5 A party p is said to be incapable of breaching a contract in a regulated two-party system 
R = {Si,S2)q, written breachlncapable p (R), if p cannot be in violation in any of the reachable states 
and transitions ofR. 

Note that a party being breach-incapable is stronger than just being compliant for one specific run — 
breachlncapable p (R) means that there is no possible trace of R, in which p breaches the contract. 

2.3 Other Modalities 

Definition 6 Permissions and obligations are duals under a notion of norm opposites and action ab- 
sence. We define the opposite of permission and obligation I & p (x) and I G p (x) syntactically in the 
following manner: 

• Party p not being permitted to perform an action is equivalent to p being obliged not to perform 
the action: I & p (a) = G p ( la) ! ^ p ( la) = G p [a) 

• Party p not being obliged to perform an action is equivalent to p being permitted not to perform 
the action: I ff p (a) = & p {la) W p (la) = &> p (a) 

It should be noted that we are equating lack of permission to do a to an obligation to perform an 
action set which does not include a. Although this seems to go against the intuitive idea of letting a 
party do nothing as a way of not violating lack of permission, note that (i) since transitions carry sets 
of actions, the empty set of actions is a way of satisfying the obligation; and (ii) well-formedness (see 
Definition [3]) of the parties ensures that progress is always possible thus making the formulation of lack 
of permission conform to our expectations. 

It is interesting to note that in a two party system there are alternative notions of opposites to per- 
mission and obligation. Consider party p not being permitted to perform action a. Apart from the 
interpretation we gave, in which the norm places the onus on party p not to perform a, an alternative 
view is to push the responsibility to p and interpret it as: party p may not provide a viable action set 
which includes a. This is distinct from lSP p {a) (and indeed from the other modalities we have). Simi- 
larly, consider party p not being obliged to perform action a. The interpretation we adopted permits party 
p to not perform a, but once again, alternative definitions may be adopted. One possibility is to push the 
responsibility to p and interpret it as: party p~ must provide a viable transition which does not include 
a. These duals, in which the outer negation of a norm also corresponds to shifting of responsibility give 
an interesting alternative view of norm opposites in a two-party system. Another interesting alternative 
would be to interpret these negations as modalities whose only effect is the cancelling of existing clauses. 
We will not explore these alternative modalities any further in this paper, since the modalities we adopt 
provide a clean notion of conflicts, as discussed in Section [3] Should they be needed for a particular 
application, any of the above mentioned interpretations could be included as alternative type of negation. 
One of the advantages of clear formal semantics is that there is no need to dispute the meaning of a given 
term, since different ones can be defined and the appropriate one be picked to convey specific meanings. 
Prohibition can now be defined as the dual of permission: 

Definition 7 Prohibition contract clauses & p {a) and & p {la), prohibiting party pfrom performing and 
not performing a respectively, can be expressed in terms of permission: 

& p {a) & \0> p {a) & p (la) ^ \& p (\a) 
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These definitions allow us to express prohibition in terms of obligation not to perform an action: 

Proposition 1 Prohibition to perform an action is equivalent to obligation not to perform the action: 
& p (x) = G p (\x). 

2.4 Contract Strength 

We can now define strictness relationships over contracts. 

Definition 8 A contract automaton si 1 is said to be stricter than contract automaton si for party p 
(or si said to be more lenient than s/' for party p ), written si Q p si' , if for any systems Si and S2, 
breachlncapable p ((S 1, S2)q ) ==> breachlncapable „( (S\,S2)q). We say that two contract automata 
si and si' are equivalent for party p, written si = p si', if si Q p si' and si' Q p s& ' . We define global 
contract strictness si C si' to hold if si Q p si' holds for all parties p, and similarly global contract 
equivalence si = si'. 

Proposition 2 The relation over contracts Q is a partial order. 
Structurally isomorphic contract automata provide a useful proof technique: 

Proposition 3 Given two structurally isomorphic contract automata si and si', si C si' if and only if 
for any state or transition X, saf^f (X) ==> sat^ (X). 

The full proof of the proposition can be found in [10]. 

Proposition 4 Contract automata are monotonic: given two structurally isomorphic contract automata 
si and si', with contract clause functions contract and contract' respectively, which satisfy that \/q ■ 
contract (q) C contract' (q), it follows that si C si'. 

Although contracts are expressed as automata, we would like to be able to compare individual 
clauses. To do this we will need to relate contract automata which are equivalent except for a partic- 
ular clause replaced by another. 

Definition 9 Given two contract clauses C and C', the relation over contract automata [C — » C'] C 
^ si x 'iosi relates two contract automata si and si' if si is equivalent to si' except possibly for a 
number of instances of clause C replaced by C". 

We extend the notion of strictness to contract clauses. We say that clause C" is stricter than clause C 
for party p, written C C p C ', if for any contract automata si and si' such that (si, si') € [C — >• C'], it 
follows that si C p si' . We similarly extend the notion of strictness for all parties C. 

The following proposition allows us to use the proof principle given in Proposition [3] for reasoning 
about clause strictness: 

Proposition 5 Given clauses C and C' , any two contract automata related by [C — > C'\ are structurally 
isomorphic. 
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2.5 Strictness Theorems 

The strictness relationship between clauses allows us to state the following theorems. 

Theorem 1 Obligation is stricter than permission: (i) 3? p {a) C G p (a); and (ii) 3? p (\a) C ff p (\d). 
Proof: We present the proof of ( i) — the proof of ( ii) is very similar. We need to prove that for any 
contract automata srf and s/' such that (&/,&/') G \£? p (a) — > @ p (a)\, then it follows that stf C stf' . 
Using Proposition \5\ we know that £/ and £/' are structurally isomorphic, allowing us to apply the 
proof principle of Proposition^ 

We thus have to show that saf^f (X) implies saf^f (X). Since the permission in srf which is replaced 
by an obligation, never yields violations for party p nor for any party on transitions, it suffices to prove 
that this implication holds on states for party ~p. 
The satisfaction function for p's obligations in states is: 

3A G acts(q p ), A' C G c ■ viable p (q^> ,AU A') 
If a G G, and since a G O p (q^i), we can conclude that a G A: 

a G G ==> 3A G acts(q p ), A' C G c • a G A Kviable p (q^i ,AUA') 
Furthermore, since q^ has less obligations than q^i, viability for q^i implies viability for q^: 

a<EG => 3A G acts(q p ), A' Cff • a G A Aviable p (q^ ,AUA') 
Hence, the satisfaction function for the permission & p {a) holds and thus, by Proposition \3\ we can 
conclude that si C 

Theorem 2 For synchronised actions, obligation for one party is stricter than permission for the other: 
(i) ^ p {a) C & p {a); and (ii) ^ p {\a) C <ff p {\a). 

It is interesting to note that if we had a weaker semantics which simply identifies a violation without 
identifying the guilty party, we would be able to show equivalence between G p [a) and G p (a), since 
a lack of a on a transition would cause a violation of both obligations. However, since our semantics 
characterise violations for the parties separately, and the partial order Q p is parametrised by the party, 
we can show that the two obligations are in fact different ifTTl . 

2.6 Mutually Exclusive Actions 

Although we adopt a multi-action approach, modelling real-world scenarios means that certain actions 
should never occur concurrently. For instance, one would expect that the automata never perform the 
action openDoor and closeDoor on the same transition. This allows us to identify strictness laws which 
hold only for mutually exclusive actions. 

Definition 10 Given a multi-action automaton (Z, Q, qO, — >), two actions a and b ( {a, b} Q ZJ are said 
to be mutually exclusive, written atxib, if they can never appear in the same set of actions on transitions. 
Thus, for any automaton, it should be the case that: 

V(q,A,q') G-> • a G A => b^A 

In the rest of the article we will assume that mutually exclusive actions never appear in the synchroni- 
sation sets. Removing this restriction, however, does not affect the results we present. The following 
theorem shows how mutually exclusive actions and action absence are related together under both obli- 
gation and permission: 

Theorem 3 If a txj b then (i) & p (\a) C ff p (b); and (ii) ^ p (\a) C &> p (b). 
A similar result can be shown, but referring to the other party in the contract: 
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Theorem 4 If a Mb then ff p {\b) C G p [d). 

Although one may be tempted to induce that a similar result can be shown for permission (analogous 
to part (ii) of Theorem [3]) — &-p-{\b) C 3^ p (a) does not always hold. As a simple example of a system 
satisfying 3? p (a) but not &-p(\b), consider party p be able to perform just one transition with action set 
{b}, and party p being able to perform one of two transitions: one with action set {a}, the other with 
action set {b}. Party p is permitted to perform a but party p is not permitted to perform \b. 

3 Conflicts 

Contract clauses are not always compatible with one another. Many definitions of conflict are possible — 
in this article we deal only with one particular class of conflicts which focusses on conflicting norms and 
mutually exclusive actions, but some interesting issues arise from party interdependence. As expected, 
the obligation on a party to perform an action a and the obligation on the same party not to perform the 
same action can never be satisfied together. Another interesting example is that of £P p (\a) and ff p {a). 
Although one is tempted to intuitively think that having the possibility of doing something other than 
a does not conflict with the obligation of doing a, multi-action semantics in contracts are different: to 
satisfy the permission party ~p must provide a-free action sets which allow p to satisfy her obligations, 
but that requires that they contain a. In this section we axiomatise the notion of conflicts in interacting 
two-party systems and investigate some consequences. 

Definition 11 Contract conflicts is a relation between contract clauses >X* G Clause o Clause and is 
defined to be the least relation satisfying the following axioms: 
Axiom 1: Opposite permissions conflict: h 2? p (x) ^ \& p (x). 

Axiom 2: Obligation to perform mutually exclusive actions is a conflict: a X b h ff p (a) ^ 0p(b). 

Axiom 3: Conflicts are closed under symmetry: C ^ C' h C' C. 

Axiom 4: Conflicts are closed under increased strictness: C >3& C AC' Q C" h C C". 

Although conflicts are only identified for opposing permissions in the axioms, they also arise in 
opposing obligations, and can be shown to follow from the axioms. 

Proposition 6 Opposite obligations conflict with each other: 6 p (x) >J» \6 p (x). 

Proposition 7 Obligation to perform an action conflicts with both permission and obligation to not 
perform it: (i) & p (x) ^ & p (\x); and (ii) & p {x) >3& ff p (\x). Obligation to perform an action also conflicts 
with lack of permission to perform the action: (Hi) & p (x) >i< \3 i p (x). 

Proposition 8 Given two conflicting clauses C\ >b C% making the two clauses stricter does not resolve 
the conflict: ifC\ C C[ and C2 E C' 2 , then C[ >Sf C' 2 . 

Example: As a simple example, consider John signing a contract with his bank. The contract says that (i) 
whenever he is logged into his Internet banking account, he is to be permitted to make money transfers; 
and (ii) if a malicious attempt to log in to his account is identified, logging in and making transfers will 
be prohibited until the situation is cleared. The two statements can be expressed in the two contract 
automata shown in Fig. Q] Combining the two statements, however results in an automaton where 
initially, after performing action set {login, malicious}, one ends up in a state with both & p (transfer) 
and J^p (transfer), which are in conflict. 
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malicious 



logout 




cleared 



Figure 1 : Internet banking contracts 



4 Related Work 



Despite the fact that contracts are, by definition, an agreement between two or more parties, most formal 
studies regulate the parties independently and do not analyse how permissions, obligations or prohibitions 
for one party affect the other, or do so in limited ways. Here we summarise the most related work. 

[3] deals with obligation violations in contracts using the domain specific BCL language [4], intro- 
ducing contrary-to-duty clauses and directed obligations, but does not analyse the reciprocity of deon- 
tic clauses in a contract. @ aims at formalisations of contracts for e-commerce but focuses only on 
analysing temporal consistency. A related line of research was started by [5 ], later followed upon by var- 
ious others ( Ifl4l l2l. etc.) — although not explicitly about contracts, they look at a flavour of axiomatic 
deontic logic with obligations being directed from one individual towards another, termed directed obli- 
gations. Directed permissions have also been studied, but were termed to be conflicting because of lack 
of a clear counterparty, following both the claimant theory or the benefit theory. Once one considers 
actions that are only realisable by the two parties in synchrony, as our approach does, the concept of 
permission appears more clearly. Although it does not fully consider many aspects of permission e.g., 
^ p (\a) - it would be interesting to direct further research to look at the similarities between both ap- 
proaches, including variations such as lfl2l . 

Our model does not provide explicitly for the notion of interference that has been analysed by many, 
notably Hohfeld @ and Lindahl JH, It is important to understand, however, that the difference between 
vested and naked liberties (i.e., warranty of immunity from interference) relates to a real concern in the 
context of general law but blurs in the context of a contract where one party allowing the other to perform 
a shared action, but reserving itself the right to interfere, does not have practical sense. More specifically, 
in our formal model 2? p {a) means not only that p may attempt to perform a — it means that p would 
succeed in doing a should she try. If the notion of attempting to do an action a that can be interfered by 
others needs to be modeled, then another action attempt_a should be added and the permission placed 
onto the latter. Another alternative is to introduce modalities for trying, as in Santos et al. lPT3Tl . 

Lindahl (8| studies liberty spaces to present the concept of less free than, a relationship between 
maximally consistent sets of deontic positions. The general idea is somewhat similar to our definition of 
strictness; however, as Lindahl notes, most of the maximally consistent sets are incomparable using this 
relationship, whereas our notion of strictness provides interesting theorems. 

Many of the above mentioned authors, and also others, deal with some definition of conflicts but they 
usually leave out the inconsistencies that arise because of the onuses imposed to the other party (see our 
example of & p (\a) conflicting with G p {d) in Section [3]). 
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5 Conclusions 

In this article we extended our formalisation of contracts for interactive systems ifTTl to deal with ab- 
sence of actions, mutually exclusive actions and conflicts. The issues raised by interaction between par- 
ties, allowing for collaboration and interference, are particularly interesting in the domain of computer- 
mediated contracts, in which systems typically work in synchrony and proceed only through handshaked 
actions. Much work has been done in this domain of synchronous systems from a Computer Science 
perspective, and we believe that our approach allows us to adopt many existing results into the field of 
contracts. We are currently applying this approach to the analysis of software requirements documents 
and studying the classes of rights identified in Kanger et al. [7 ] in an interactive setting. 
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